2 * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
3 * Copyright (C) 1999-2001 Internet Software Consortium.
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
10 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
11 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
12 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15 * PERFORMANCE OF THIS SOFTWARE.
18 /* $Id: acl.h,v 1.20.2.1 2004/03/09 06:11:12 marka Exp $ */
28 * Address match list handling.
36 #include <isc/magic.h>
37 #include <isc/netaddr.h>
38 #include <isc/refcount.h>
41 #include <dns/types.h>
48 dns_aclelementtype_ipprefix
,
49 dns_aclelementtype_keyname
,
50 dns_aclelementtype_nestedacl
,
51 dns_aclelementtype_localhost
,
52 dns_aclelementtype_localnets
,
53 dns_aclelementtype_any
54 } dns_aclelemettype_t
;
56 typedef struct dns_aclipprefix dns_aclipprefix_t
;
58 struct dns_aclipprefix
{
59 isc_netaddr_t address
; /* IP4/IP6 */
60 unsigned int prefixlen
;
63 struct dns_aclelement
{
64 dns_aclelemettype_t type
;
65 isc_boolean_t negative
;
67 dns_aclipprefix_t ip_prefix
;
76 isc_refcount_t refcount
;
77 dns_aclelement_t
*elements
;
78 unsigned int alloc
; /* Elements allocated */
79 unsigned int length
; /* Elements initialized */
80 char *name
; /* Temporary use only */
81 ISC_LINK(dns_acl_t
) nextincache
; /* Ditto */
87 isc_boolean_t match_mapped
;
90 #define DNS_ACL_MAGIC ISC_MAGIC('D','a','c','l')
91 #define DNS_ACL_VALID(a) ISC_MAGIC_VALID(a, DNS_ACL_MAGIC)
100 dns_acl_create(isc_mem_t
*mctx
, int n
, dns_acl_t
**target
);
102 * Create a new ACL with room for 'n' elements.
103 * The elements are uninitialized and the length is 0.
107 dns_acl_appendelement(dns_acl_t
*acl
, dns_aclelement_t
*elt
);
109 * Append an element to an existing ACL.
113 dns_acl_any(isc_mem_t
*mctx
, dns_acl_t
**target
);
115 * Create a new ACL that matches everything.
119 dns_acl_none(isc_mem_t
*mctx
, dns_acl_t
**target
);
121 * Create a new ACL that matches nothing.
125 dns_acl_attach(dns_acl_t
*source
, dns_acl_t
**target
);
128 dns_acl_detach(dns_acl_t
**aclp
);
131 dns_aclelement_equal(dns_aclelement_t
*ea
, dns_aclelement_t
*eb
);
134 dns_acl_equal(dns_acl_t
*a
, dns_acl_t
*b
);
137 dns_acl_isinsecure(dns_acl_t
*a
);
139 * Return ISC_TRUE iff the acl 'a' is considered insecure, that is,
140 * if it contains IP addresses other than those of the local host.
141 * This is intended for applications such as printing warning
142 * messages for suspect ACLs; it is not intended for making access
143 * control decisions. We make no guarantee that an ACL for which
144 * this function returns ISC_FALSE is safe.
148 dns_aclenv_init(isc_mem_t
*mctx
, dns_aclenv_t
*env
);
151 dns_aclenv_copy(dns_aclenv_t
*t
, dns_aclenv_t
*s
);
154 dns_aclenv_destroy(dns_aclenv_t
*env
);
157 dns_acl_match(isc_netaddr_t
*reqaddr
,
158 dns_name_t
*reqsigner
,
162 dns_aclelement_t
**matchelt
);
164 * General, low-level ACL matching. This is expected to
165 * be useful even for weird stuff like the topology and sortlist statements.
167 * Match the address 'reqaddr', and optionally the key name 'reqsigner',
168 * against 'acl'. 'reqsigner' may be NULL.
170 * If there is a positive match, '*match' will be set to a positive value
171 * indicating the distance from the beginning of the list.
173 * If there is a negative match, '*match' will be set to a negative value
174 * whose absolute value indicates the distance from the beginning of
177 * If there is a match (either positive or negative) and 'matchelt' is
178 * non-NULL, *matchelt will be attached to the primitive
179 * (non-indirect) address match list element that matched.
181 * If there is no match, *match will be set to zero.
184 * ISC_R_SUCCESS Always succeeds.
188 dns_aclelement_match(isc_netaddr_t
*reqaddr
,
189 dns_name_t
*reqsigner
,
192 dns_aclelement_t
**matchelt
);
194 * Like dns_acl_match, but matches against the single ACL element 'e'
195 * rather than a complete list and returns ISC_TRUE iff it matched.
196 * To determine whether the match was prositive or negative, the
197 * caller should examine e->negative. Since the element 'e' may be
198 * a reference to a named ACL or a nested ACL, the matching element
199 * returned through 'matchelt' is not necessarily 'e' itself.
204 #endif /* DNS_ACL_H */